A zone provides isolation at almost any level of granularity you require.A zone does not need a dedicated CPU, a physical device, or a portion of physicalmemory. These resources can either be multiplexed across a number of zonesrunning within a single domain or system, or allocated on a per-zone basisusing the resource management features available in the operating system.
Each zone can provide a customized set of services. To enforce basicprocess isolation, a process can see or signal only those processes that existin the same zone. Basic communication between zones is accomplished by givingeach zone IP network connectivity. An application running in one zone cannotobserve the network traffic of another zone. This isolation is maintainedeven though the respective streams of packets travel through the same physicalinterface.
Each zone is given a portion of the file system hierarchy. Because eachzone is confined to its subtree of the file system hierarchy, a workloadrunning in a particular zone cannot access the on-disk data of another workloadrunning in a different zone.
Files used by naming services reside within a zone's own root file systemview. Thus, naming services in different zones are isolated from one otherand the services can be configured differently.